Single AD User not found in Import / & possible related Unity-Phone issues

[kenjohnson]

We just recently finished an upgrade from Unity 3.1.5 to Unity 4.0(4) SR 1.

We have a weird situation where all the existing subscribers who existed before the configuratrion are working okay - but they are not able to access unity over the phone - they enter their name and password - and then the system pauses before coming back with "not able to process your request at this time." They are able to receive voicemail fine in their inbox. Password changes didn't help.

As a work-around, we discovered that if we deleted the subsriber and recreated him/her everything worked fine.

However, recently, we deleted five subscribers (all in one Active Directory department OU) and recreated them. FOur worked fine - but the fifth, simple disappeared from Unity and no longer showed up in an import query either.

We've checked permissions manually and they appear to be identical to the other subscribers- the directory access diagnostics tool reports no problems either for the specific user of the relevant mailstore.

We are running on unity 4.0(4) SR 1 and the Exchange server is Exchange 2000 SR3 with the latest rollup - although we do have a test Exchange 2003 server installed (with no production users on it) and as a result the AD tree is now proepped for E2K3.

Any ideas either why this user won't show up - or (if it goes to a larger issue) why the specific phone-in capability seemed to die for all these users when nothing else did?

Thanks in advance for any ideas :-)

- Ken

[lindborg · Accepted solution]

As for the users failing when they logged in - we'd need to see the application event log errors that were added when the user got the failsafe conversation - dimes to dollars the login for the mailstore for that user was failing due to permissions issues of some sort. Presumably you changed the service account configuration when you upgraded? 3.1(5) used a single account for directory/mailstore access by default and 4.x uses two seperate accounts. Just a guess without any kind of errors to look at but that'd be my first assumption.

As for the guy going missing - you'd want to look at the raw AD properties on that guy - in particular the ciscoECSBULocationObjectId value and ciscoECSBULocationObjectType (I believe those names are correct - I'm not in front of a Unity box at the moment) - if we're not showing them for import it usually means we see that one or both of those is set and we assume they are a subscriber on another Unity box in the directory or the like. I'd first check all the "ciscoECSBUxxx" properties on that guy and see what they are set to and go from there.

[kenjohnson]

Thanks!

You were right on the ciscoECSBU objects - there were a few with remaining values - and i know why now :-/ We had manually changed permissions on that one user object to grant some specific rights but that had turned off inheitence so unity's new accoutns (yes we did change to the two AD accounts) couldn't access it.

I cleared all the ciscoSCSBU attributes in ADSIedit, and restored inheritenc and that user is working again.

I should have done this first, but on the phone login failing, I did a DBWalk andI appear to be getting about 120 errors (out of about 2000 users) of the following:

1619:(error) The MailboxStoreObjectID value referenced for this subscriber is not found in the MailboxStore table in the database. This is a serious error, you should contact TAC for help.

So far - these seem to correpsond to the users having problems. When I delete the unity accounts and recreate them - they can log back into the phone okay AND they disappear from the updated DBWalker report.

now that i know this - i can theorize thatr i know who is affected and at only 120 i can propblebly delete and recreate them since that appears to resolve known user and DBWalk issues - unless you think there's an underlying issue i should be pursuing...

Also - is there any capability in DIRT or otherwise to backup only specific names and greetings and programatically reassociate them with specific accounts? I can delete/recreate manually at only 120 - but it's be more fun programatically :-)

Thanks for the helpful tips!

Ken Johnson

Mgr. Network Services

LeTourneau University

--------

Cisco IP Telephony Users Group

http://www.ciptug.org

[lindborg]

No, DiRt is an "all or nothing" thing since it's backing up the DBs in one shot, it doesn't back up just selected rows/objects/properties. I did that with FullDBImport/Export way back when and it was an ongoing support nightmare with each version of Unity - just about did me in. System migration in one shot is far more maintainable.

A specific tool to migrate just greetings, voice names and passwords or something is probably doable but a generic user migration tool is difficult because of the interdependencies between other objects on the system (i.e. links to COS objects, schedules, application objects, locations etc...) - they have to be dynamically patched up on the system you're restoring to which is moderately messy stuff...

[kenjohnson]

I figured as much - i'll do them manually - at least it's not all 2000 :-)

Thanks for the help!

- ken